logo-pack
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches brand logo assets from external sources, including user-provided URLs, Simple Icons (cdn.simpleicons.org), and Google's favicon service (google.com/s2/favicons). This is the core functionality for building the logo pack.
- [DYNAMIC_EXECUTION]: The Node.js script
logos.mjsuses the Chrome DevTools Protocol to evaluate JavaScript strings within a headless browser instance. This is used for image manipulation tasks such as trimming transparent pixels and generating a contact sheet (logos-sheet.png). The script safely interpolates data into these execution contexts using JSON stringification. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from video transcripts (
captions.jsonorwords.json) to extract brand names. While this represents an ingestion point for external content, the risk is mitigated as the extracted names are sanitized via a slugging function before being used in file paths, and the subsequent logic is limited to image processing and metadata updates.
Audit Metadata